Overview
overview
7Static
static
3pepew(Copy 10).bat
windows10-2004-x64
7pepew(Copy 11).bat
windows10-2004-x64
7pepew(Copy 12).bat
windows10-2004-x64
7pepew(Copy 13).bat
windows10-2004-x64
7pepew(Copy 14).bat
windows10-2004-x64
7pepew(Copy 15).bat
windows10-2004-x64
7pepew(Copy 16).bat
windows10-2004-x64
7pepew(Copy 17).bat
windows10-2004-x64
7pepew(Copy 18).bat
windows10-2004-x64
7pepew(Copy 19).bat
windows10-2004-x64
7pepew(Copy 2).bat
windows10-2004-x64
7pepew(Copy 20).bat
windows10-2004-x64
7pepew(Copy 21).bat
windows10-2004-x64
7pepew(Copy 22).bat
windows10-2004-x64
7pepew(Copy 23).bat
windows10-2004-x64
7pepew(Copy 24).bat
windows10-2004-x64
7pepew(Copy 25).bat
windows10-2004-x64
7pepew(Copy 26).bat
windows10-2004-x64
7pepew(Copy 27).bat
windows10-2004-x64
7pepew(Copy 28).bat
windows10-2004-x64
7pepew(Copy 29).bat
windows10-2004-x64
7pepew(Copy 3).bat
windows10-2004-x64
7pepew(Copy 30).bat
windows10-2004-x64
7pepew(Copy 31).bat
windows10-2004-x64
7pepew(Copy 32).bat
windows10-2004-x64
7pepew(Copy 4).bat
windows10-2004-x64
7pepew(Copy 5).bat
windows10-2004-x64
7pepew(Copy 6).bat
windows10-2004-x64
7pepew(Copy 7).bat
windows10-2004-x64
7pepew(Copy 8).bat
windows10-2004-x64
7pepew(Copy 9).bat
windows10-2004-x64
7pepew(Copy).bat
windows10-2004-x64
7Analysis
- max time kernel
1795s - max time network
1802s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
20/11/2024, 02:23
Static task
static1
Behavioral task
behavioral1
Sample
pepew(Copy 10).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
pepew(Copy 11).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
pepew(Copy 12).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
pepew(Copy 13).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
pepew(Copy 14).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
pepew(Copy 15).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
pepew(Copy 16).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
pepew(Copy 17).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
pepew(Copy 18).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
pepew(Copy 19).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
pepew(Copy 2).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
pepew(Copy 20).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
pepew(Copy 21).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
pepew(Copy 22).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
pepew(Copy 23).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
pepew(Copy 24).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
pepew(Copy 25).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
pepew(Copy 26).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
pepew(Copy 27).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
pepew(Copy 28).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
pepew(Copy 29).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
pepew(Copy 3).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
pepew(Copy 30).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
pepew(Copy 31).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
pepew(Copy 32).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
pepew(Copy 4).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
pepew(Copy 5).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
pepew(Copy 6).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
pepew(Copy 7).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
pepew(Copy 8).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
pepew(Copy 9).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
pepew(Copy).bat
Resource
win10v2004-20241007-en
windows10-2004-x64
General
- Target pepew(Copy 12).bat
- Size 176B
- Sample241120-ct6tpstjfj
- SHA256 d33dae0ac1cb109e5f9a9caa3197ce9562a588f36e02424aa6ca010ec2f77af0
- MD5 1a798e3c98e4415eabd98723c902406c
- SHA1 a7458581782cbe7ba181a4cb92c6c64e3ddc33a8
- SHA512 76ef5e9fa9b42a9b8b671a4c1b7ca583d6f3414921ebb8488a08eaf20f5ca15afabad0d3a359d226169940f37d82847bfbfdc289a71169d703e47c9258dcc5a5
- MD5 SHA1 SHA512
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe 4948 SRBMiner.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLockMemoryPrivilege 4948 SRBMiner.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 4948 3000 cmd.exe 84 PID 3000 wrote to memory of 4948 3000 cmd.exe 84 PID 4948 wrote to memory of 1568 4948 SRBMiner.exe 87 PID 4948 wrote to memory of 1568 4948 SRBMiner.exe 87
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pepew(Copy 12).bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\SRBMiner.exeSRBMiner.exe --algorithm xelishashv2_pepew --pool stratum+tcp://na.mining4people.com:4176 --wallet PRnLRcurtkNtVx2MYeKrVUWWk9oRPLk4zM --password x --worker RiG12 --disable-gpu2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c set3⤵PID:1568
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\evb9125.tmp
- Size 1KB
- SHA256 145450471b410b8b6dac975d43f0b9dbcda06747ac41b87e93fb33c3d7f77e3c
- MD5 4998c826b605ee77c13a2018618facb4
- SHA1 6c60755c430669f9d4c14c63001b222a53a5b5fb
- SHA512 9dc7fdfbc26fe06599c70d2999952fe64d19faa39896e32a7f10e8c765f51bc9670569eb702de43e426a2fad36ac5a4a9955d415523ccda5733af8f741b7dec2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\evb9184.tmp
- Size 1KB
- SHA256 a9356cd19cf5f28575aa2531b900711fcf229505cb07381f8de30c210b62e09c
- MD5 ca71ec205cde2578292b6b7afc68af7a
- SHA1 176960a041c3faa545ee95835ea23b3bd6ebefff
- SHA512 2cb22f163f4e7b5d77254113f81a54918fd0bf21004f41f783216031759e97693eb58230532edb918b1e5dc3a0fff80f06b5504e88c386721dc0934809bbd0b4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\evb91A4.tmp
- Size 1KB
- SHA256 02d479a16dd1b7d35718422d579e4cf8800b17c89bbed276e0c4d7fa5bf07eba
- MD5 be10ecef22e448c25fa481e75cab6f14
- SHA1 6205232aa5d8fafa2aa3d7101221372d4ec979e1
- SHA512 d33ed5bc85adf6cefc9a6fa949c3055ecdb7fb8058766772bdd5065b97f8e6a797474980039435b96d315c4b8e9f46d270b149e2fe216677a924cedb8eb75072
- MD5 SHA1 SHA512